[superdav42]

Summary

• Bump the js-yaml override from 4.3.1 to 4.3.2 (the minimum patched version) in package.json and pnpm-workspace.yaml. pnpm 11 reads overrides from pnpm-workspace.yaml, so changing package.json alone does not update the lockfile.
• Regenerate pnpm-lock.yaml with pnpm install --lockfile-only. Every js-yaml reference now resolves to 4.3.2.

Testing

• pnpm install --lockfile-only --ignore-scripts passed the lockfile supply-chain policy check.
• pnpm audit no longer lists js-yaml. The 9 findings still reported are other packages (extract-zip, http-cache-semantics, ajv, yaml, colord, vue) and are out of scope.
• full-loop-helper.sh commit-and-pr failed its workspace validator ("pnpm-workspace.yaml has no supported package patterns"), because that file only holds settings and has no packages: key. I created the PR manually.

Resolves #1807

---

Summary by CodeRabbit

• Chores
  • Updated the YAML processing package to version 4.3.2 and aligned its version across workspace configuration.
  • This is a maintenance update. No changes to public interfaces or end-user features are noted in this release.

[superdav42]

Bumps the js-yaml override from 4.3.1 to 4.3.2 in package.json and pnpm-workspace.yaml, and regenerates pnpm-lock.yaml. Verified with pnpm install --lockfile-only and pnpm audit, which no longer lists js-yaml. Resolves #1807.

---

aidevops.sh v3.39.49 plugin for OpenCode v1.19.0 with claude-sonnet-5-5 spent 1m and 3,533 tokens on this as a headless worker.

---

Merged via PR #2033 to main.
Merged by deterministic merge pass (pulse-wrapper.sh).

Routing feedback

• Route: standard; 4 attempts, 40 LLM requests, 0 capability escalations, 0 same-tier fallbacks.
• Population: headless; 0 objective outcomes.
• Usage: 2,403,087 tokens; $0.9554 estimated cost.
• Recommendation: Provider/runtime failures dominated retries; keep the workload tier and review candidate health before raising capability.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1

• assets/js/dns-table.min.js is excluded by !**/*.min.js

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: a70bb955-025c-497c-ada2-a9af23fbbbeb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: ac015924-3037-444c-8711-e58926c2e563

Commits

Reviewing files that changed from the base of the PR and between f6a4c96 and 4c4ba81.

Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 2

• package.json
• pnpm-workspace.yaml

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

Walkthrough

The js-yaml override changes from version 4.3.1 to 4.3.2 in package.json and pnpm-workspace.yaml.

Changes: js-yaml Override Update

Layer / File(s)	Summary
Update js-yaml override package.json, pnpm-workspace.yaml	Both files change the js-yaml override from version 4.3.1 to 4.3.2.

Priority: Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other · Severity of issue fixed: High

Merge Risk: Minimal · previous review 4c4ba

The dependency update is ready to merge; no current-head issues remain.

Pre-merge checks: 4 · 1

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Linked Issues check		Issue #1807 requires package.json and pnpm-lock.yaml to resolve js-yaml to at least 4.3.2, plus the package-manager audit and repository quality gate. The reviewed changes show the override upda…	Provide reviewable evidence that the excluded pnpm-lock.yaml resolves all js-yaml entries to at least 4.3.2, and report the repository quality gate result. Confirm the GitHub alert outcome if required by issue #1807.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the dependency alert remediation and the exact js-yaml version update, which matches the primary changeset.
Out of Scope Changes check		The reviewed changes only update the js-yaml override in package.json and pnpm-workspace.yaml. The workspace-file change supports pnpm 11 override resolution for issue #1807. No unrelated change…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within survi…

Full details: Out of Scope Changes check

Explanation

The reviewed changes only update the js-yaml override in package.json and pnpm-workspace.yaml. The workspace-file change supports pnpm 11 override resolution for issue #1807. No unrelated change is shown.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Full details: Linked Issues check

Explanation

Issue #1807 requires package.json and pnpm-lock.yaml to resolve js-yaml to at least 4.3.2, plus the package-manager audit and repository quality gate. The reviewed changes show the override update in package.json and pnpm-workspace.yaml. The PR summary reports lockfile regeneration and audit success, but pnpm-lock.yaml is intentionally excluded from review, so its resolved versions cannot be independently established. The summary does not report the repository quality gate or GitHub alert status.

Resolution

Provide reviewable evidence that the excluded pnpm-lock.yaml resolves all js-yaml entries to at least 4.3.2, and report the repository quality gate result. Confirm the GitHub alert outcome if required by issue #1807.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔨 Build Complete - Ready for Testing!

📦 Download Build Artifact (Recommended)

Download the zip build, upload to WordPress and test:

• Build: ultimate-multisite
• ⬇️ Download from GitHub Actions
• ⬇️ Download without Github Account (nightly.link)

🌐 Test in WordPress Playground (Very Experimental)

Click the link below to instantly test this PR in your browser - no installation needed!
Playground support for multisite is very limitied, hopefully it will get better in the future.

🚀 Launch in Playground

Login credentials: admin / password

[superdav42]

CI repair feedback routed to issue #1807

This worker PR had terminal failed CI checks. The check details have been appended
to the linked issue body so the next worker can address them.

Terminal failed checks:

• Build Plugin for Testing: failure — check URL — primary failing-check evidence

Closed by deterministic merge pass (pulse-merge.sh).

[github-actions]

🔨 Build Complete - Ready for Testing!

📦 Download Build Artifact (Recommended)

Download the zip build, upload to WordPress and test:

• Build: ultimate-multisite
• ⬇️ Download from GitHub Actions
• ⬇️ Download without Github Account (nightly.link)

🌐 Test in WordPress Playground (Very Experimental)

Click the link below to instantly test this PR in your browser - no installation needed!
Playground support for multisite is very limitied, hopefully it will get better in the future.

🚀 Launch in Playground

Login credentials: admin / password